CVE-2026-81928: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-81928 is a denial-of-service vulnerability in the Net::DNS Perl module (versions before 1.57) caused by unbounded recursion in the sig_data function when re-encoding a DNS message containing a misplaced TSIG record. The vulnerability was published on September 2, 2026, and assigned by CPANSec. It affects all Net::DNS releases prior to 1.57; version 1.57 contains the fix. A CVSS score has not yet been formally assigned, though Feedly estimates the severity as Medium (GitHub Advisory).

The root cause is CWE-674 (Uncontrolled Recursion) in the sig_data function within Net/DNS/RR/TSIG.pm. When sig_data signs a message, it re-encodes it and strips TSIG records only from the additional section; a TSIG record decoded into the answer or authority section is not removed and is signed again, causing sig_data to call itself recursively with no termination condition. The recursion is only triggered when the misplaced TSIG carries an empty MAC — a MAC recovered from the wire short-circuits the signing step and is therefore safe. Additionally, the decoder does not reject such malformed messages: a misplaced TSIG raises a "misplaced or corrupt TSIG" warning but the record is retained in the packet, violating RFC 8945 section 5.2 which mandates the message be dropped. Because each recursive cycle re-encodes the entire message, a crafted packet of fewer than 100 bytes is sufficient to exhaust process memory (GitHub Advisory, RFC 8945).

Successful exploitation causes memory exhaustion and process termination in any application that decodes and then re-encodes DNS messages using the vulnerable Net::DNS module, such as DNS forwarders and proxies. An unauthenticated remote attacker can crash the affected service with a single crafted DNS message (query or response) of fewer than 100 bytes, resulting in a complete availability loss for the DNS forwarding or proxying function. Applications that only decode messages without re-encoding them are not affected (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of publication. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires no authentication and no user interaction, but is limited to systems that re-encode decoded DNS messages (forwarders/proxies), reducing the exposed attack surface (GitHub Advisory).

1. Identify target: Locate a DNS forwarder or proxy that uses the Net::DNS Perl module (version < 1.57) to decode and re-encode DNS messages.
2. Craft malicious DNS message: Construct a DNS message (query or response) containing a TSIG record placed in the answer or authority section rather than the additional section, with the TSIG MAC field set to empty (zero-length).
3. Send the packet: Transmit the crafted DNS message (fewer than 100 bytes) to the target forwarder or proxy over UDP or TCP port 53.
4. Trigger unbounded recursion: The target decodes the message, retains the misplaced TSIG record with a warning, and when re-encoding for forwarding, sig_data recursively calls itself without termination, exhausting available memory.
5. Process crash: The target process is terminated due to memory exhaustion, causing a denial of service for all DNS queries it was handling (GitHub Advisory).

• Logs: Repeated Perl warnings such as "misplaced or corrupt TSIG" in DNS application logs immediately before a process crash; out-of-memory (OOM) kill events in system logs (/var/log/syslog, dmesg, or journalctl) referencing the DNS forwarder/proxy process.
• Process: Sudden termination of the DNS forwarder or proxy process; abnormal memory growth visible in process monitoring tools (e.g., top, ps) for the Perl-based DNS service prior to crash.
• Network: Inbound DNS messages (UDP/TCP port 53) of unusually small size (< 100 bytes) containing a TSIG record not in the additional section; repeated connection attempts from the same source IP following service restarts.

The primary remediation is to upgrade Net::DNS to version 1.57 or later, which fixes the unbounded recursion by properly handling misplaced TSIG records (Net-DNS 1.57 Changelog). As a network-level workaround, deploy firewall or IDS rules to drop DNS messages containing TSIG records outside the additional section before they reach vulnerable systems. Additionally, resource limits (e.g., ulimit or cgroup memory caps) on the DNS forwarder/proxy process can reduce the blast radius of a successful attack by preventing full system memory exhaustion (GitHub Advisory).